Data Recovery Case File · Formatted & Logical Faults · Cut, Paste, Interrupted

The move that stopped at 96%: where 12,000 pictures go when a cut-and-paste is interrupted — the empty-folders-on-both-sides limbo decoded, and the two-drive recovery that brought the collection back together

Her report described the moment every mass file move threatens. "I created one big folder with small different folders inside, with 12,000 pics, and wanted to move them to my hard disk. I cut them and pasted them to my hard disk. When it was at 96% I had a message: interrupted action — are you sure you want to copy this file without its properties? First I clicked skip, then it happened again, so I clicked cancel." The aftermath: "some folders on the hard disk had pictures, but some had a name and there wasn't any pictures inside — and they are not on the desktop folder either." Pictures gone from both ends of the move: the limbo that makes cut-and-paste the most nerve-testing command in computing. This page decodes exactly where those pictures are — because they are somewhere, and the somewhere is recoverable — and why the golden rule for anything precious is copy first, delete after, never cut.

The decode: what "cut" really does, and where the limbo lives

A move is a copy with a deletion stapled on: when you cut-and-paste between two drives, the computer can't teleport data — it performs, file by file, a copy to the destination followed by a delete at the source. While everything works, the staple is invisible. But interrupt the run at 96% and the seam shows: thousands of files have completed the full cycle — copied across, deleted behind — while the files in flight and after the stop are stranded wherever their individual cycle had reached. Her both-sides emptiness is that seam made visible: folders whose structure was created at the destination before their contents finished arriving, and source copies already deleted for files whose destination writes didn't complete cleanly. The "copy without its properties?" dialog was the tripwire — a file whose metadata couldn't travel, stalling the pipeline — and skip-then-cancel froze the whole procession mid-stride.

Why the pictures aren't gone — either side: the reassuring anatomy, in two halves. At the source: "deleted" after a move means what deletion always means in this archive — the entries unlinked, the picture data left in place on the disk until something overwrites it. Freshly-deleted files on a desktop drive are among the most recoverable objects in computing, provided the machine is rested: every hour of continued use writes over the very space the collection occupies, so the source computer's retirement from duty is the single urgent instruction. At the destination: the successfully-moved 96% is simply there, and the partially-written stragglers are identifiable and repairable or re-coverable from the source's deleted copies. Between the two drives, every one of the 12,000 exists somewhere — the recovery's job is to find each picture on whichever side holds its best copy, and put the collection back together.

The rule the incident writes: for anything irreplaceable, never cut — copy, verify the copies open at the destination, and only then delete the originals. Copy-verify-delete costs one extra step and removes the limbo entirely: an interrupted copy leaves the source untouched, and the worst case becomes "run it again."

On the bench

Both drives were imaged write-blocked in parallel on the Atola TaskForce 2 — the source captured before another byte could land on the deleted collection, the destination fixed as the interruption left it. On the source image, the recently-deleted entries were recovered — the move's staple unpicked, the vanished originals re-listed with their folder homes; on the destination image, the completed 96% was harvested and the stragglers assessed. The two sets were then reconciled: each of the 12,000 taken from whichever side held its intact copy, duplicates resolved, the original folder structure reassembled. OSForensics closed the case the way a collection this size demands — a verified manifest, the count confirmed and the pictures opening — before delivery on fresh media.

The outcome

The 12,000-picture collection reunited from both sides of the interrupted move, verified by manifest, and delivered. Free assessment, one fixed written figure including VAT, no recovery, no fee. The limbo, mapped for everyone who's watched a move die at 96%: cut-and-paste is a copy with a deletion stapled on, an interruption strands files on both sides of the staple, the deleted originals remain recoverable exactly as long as the source is rested — and the rule that retires the whole drama is three words long: copy, verify, delete.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.